This advisory covers a security update for Red Hat Satellite 6.18.5 on RHEL 9 that addresses eight distinct vulnerabilities across several software components. Notably, multiple SQL injection vulnerabilities in python3.12-django (CVE-2026-1287, CVE-2026-1207, CVE-2026-1312) are fixed. Denial of service vulnerabilities in python3.12-django (CVE-2026-1285, CVE-2025-14550), python3.12-markdown (CVE-2025-69534), and rubygem-activesupport (CVE-2026-33176) are also addressed. Additionally, a buffer overflow in python3.12-pyOpenSSL (CVE-2026-27459) is fixed. The update is intended to improve security by patching these issues in the Satellite system management solution, which facilitates provisioning and configuration management without requiring public internet access.

The vulnerabilities fixed include multiple SQL injection flaws that could allow attackers to manipulate database queries, denial of service conditions that could disrupt service availability, and a buffer overflow that could potentially lead to memory corruption. These issues collectively pose a high risk to the confidentiality, integrity, and availability of systems managed by Red Hat Satellite 6.18. Exploitation could lead to unauthorized data access, service disruption, or potential code execution depending on the vulnerability.

Red Hat has released an updated version of Red Hat Satellite 6.18.5 for RHEL 9 that addresses these vulnerabilities. Users should apply this update promptly after ensuring all previously released errata relevant to their systems have been applied. Detailed update instructions are available in the Red Hat Satellite documentation. No additional mitigations are specified beyond applying the official update.